> This patch adds MSVC's "/guard:signret" flag to the C/C++ compilation
> flags so that the VM code includes signing and authentication
> instructions to ensure that the return address is not tampered by any
> callee. Specifically, MSVC chooses signing using the B key, so every
> non-leaf function starts with the `pacibsp` instruction (for signining
> the return address) and ends with the `autibsp` instruction (for
> authenticating the return address). Both `pacibsp` and `autibsp`
> instructions are in the NOP space, so older AArch64 processors that do
> not support these instructions shouldn't be impacted by these
> instructions.
>
> As a matter of slight detail, this patch adds the "/guard:signret" flag
> only when the OpenJDK build is passed the "--enable-branch-protection"
> flag, which is off by default. Consequently, this change will not
> impact ordinary builds of OpenJDK.
>
> I've validated this patch by running the test/jdk:tier{1,2,3},
> test/hotspot/jtreg:tier{1,2,3}, test/langtools:tier{1,2,3}, and
> test/lib-test:tier1 tests with branch protection enabled. This patch
> does not introduce any new failures.
>
> ---------
> - [x] I confirm that I make this contribution in accordance with the [OpenJDK
> Interim AI Policy](https://openjdk.org/legal/ai).
Ashay Rane has updated the pull request with a new target base due to a merge
or a rebase. The incremental webrev excludes the unrelated changes brought in
by the merge/rebase. The pull request contains five additional commits since
the last revision:
- Drop incorrect comment
- Merge branch 'master' into JDK-8387792-pac-ret-windows-arm64
- Remove signature while walking the stack
- Use separate C{XX} and AS flags for branch protection
- Add "/guard:signret" to build flags when branch protection is requested
This patch adds MSVC's "/guard:signret" flag to the C/C++ compilation
flags so that the VM code includes signing and authentication
instructions to ensure that the return address is not tampered by any
callee. Specifically, MSVC chooses signing using the B key, so every
non-leaf function starts with the `pacibsp` instruction (for signining
the return address) and ends with the `autibsp` instruction (for
authenticating the return address). Both `pacibsp` and `autibsp`
instructions are in the NOP space, so older AArch64 processors that do
not support these instructions shouldn't be impacted by these
instructions.
As a matter of slight detail, this patch adds the "/guard:signret" flag
only when the OpenJDK build is passed the "--enable-branch-protection"
flag, which is off by default. Consequently, this change will not
impact ordinary builds of OpenJDK.
I've validated this patch by running the test/jdk:tier{1,2,3},
test/hotspot/jtreg:tier{1,2,3}, test/langtools:tier{1,2,3}, and
test/lib-test:tier1 tests with branch protection enabled. This patch
does not introduce any new failures.
-------------
Changes:
- all: https://git.openjdk.org/jdk/pull/31795/files
- new: https://git.openjdk.org/jdk/pull/31795/files/f94f2c35..b1f09f10
Webrevs:
- full: https://webrevs.openjdk.org/?repo=jdk&pr=31795&range=01
- incr: https://webrevs.openjdk.org/?repo=jdk&pr=31795&range=00-01
Stats: 4860 lines in 258 files changed: 2846 ins; 1187 del; 827 mod
Patch: https://git.openjdk.org/jdk/pull/31795.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/31795/head:pull/31795
PR: https://git.openjdk.org/jdk/pull/31795
